diff --git a/src/core.ts b/src/core.ts index 1440fe4e..6de79385 100644 --- a/src/core.ts +++ b/src/core.ts @@ -247,9 +247,11 @@ export function applyOperation(document: T, operation: Operation, validateOpe } while (true) { key = keys[t]; - - if(banPrototypeModifications && key == '__proto__') { - throw new TypeError('JSON-Patch: modifying `__proto__` prop is banned for security reasons, if this was on purpose, please set `banPrototypeModifications` flag false and pass it to this function. More info in fast-json-patch README'); + if(banPrototypeModifications && + (key == '__proto__' || + (key == 'prototype' && t>0 && keys[t-1] == 'constructor')) + ) { + throw new TypeError('JSON-Patch: modifying `__proto__` or `constructor/prototype` prop is banned for security reasons, if this was on purpose, please set `banPrototypeModifications` flag false and pass it to this function. More info in fast-json-patch README'); } if (validateOperation) {